phemedrone | 6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
Size

246KB
MD5

bcb323eb0cfd10d58cf134bc7bdc8d67
SHA1

c34a8c428b715b67b696819fc1d172708a23d3f3
SHA256

6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3
SHA512

bac5411c794a1b473b628c5b261bef5a830a6fed5a797c785ac3f3370def8f91db2368db8ea13d91ece0b89ab6109b64e3ecddcd27d15b2d7cc6f29216a57255
SSDEEP

3072:YlXc8ISCQhQzh6OVoWlq5OiUG5QivXsP1zpKHDkO7UN2ET:yUSbSzh6OzgOiUOvrU0

Score

10^/10

phemedrone stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot8091768794:AAFZsJ1h-6BiszgyLm-eH6c-uITQ7Z99Wbc/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

pid	process
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

description pid process

Token: SeDebugPrivilege 876 6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

description	pid	process
Token: SeDebugPrivilege	876	6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

C:\Users\Admin\AppData\Local\Temp\6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
"C:\Users\Admin\AppData\Local\Temp\6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-0-0x00007FFD67863000-0x00007FFD67865000-memory.dmp

Filesize
8KB

Download
memory/876-1-0x00000249963C0000-0x0000024996404000-memory.dmp

Filesize
272KB

Download